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IN THE CLAIMS 

Please amend the claims as follows. 

1 . (Currently Amended) A computer implemented method to diagnose a problem from 
multiple events in a system of managed components generating real-time events of problems, 
comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
sampling generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

2. (Original) The method of claim 1, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

3. (Original) The method of claim 2, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 
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4. (Original) The method of claim 3, wherein the system comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 

5. (Original) The method of claim 3, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

6. (Previously Presented) The method of claim 5, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 

7. (Original) The method of claim 6, wherein determining the event nodes comprises: 
determining the event nodes from a database defining the network managed objects and 

event notifications that convey the state of one or more managed objects. 

8. (Original) The method of claim 7, wherein determining the event nodes further 
comprises: 

determining the event nodes from expert knowledge of the network. 

9. (Original) The method of claim 8, wherein the managed objects comprise: 
objects selected from the group consisting of network objects, attached systems, and 

application objects. 

1 0. (Previously Presented) The method of claim 8, wherein the database comprises: 
static information associated with each class of managed or dynamic information that 

affects the causal propagation of events. 

11. (Original) The method of claim 3, wherein sampling the incoming real-time events 
comprises: 

sampling the incoming real-time events sequentially in the order they are received. 
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12. (Original) The method of claim 3, wherein identifying the concept nodes comprises: 
identifying a composite set of events that capture the notion of an abstract exception 

condition in the network. 

13. (Original) The method of claim 12, wherein the abstract exception condition comprises: 
abstract exception conditions selected from the group consisting of a notion of fault and a 

notion of performance degradation, a network card in a communication system being faulty with 
the number of users being served by the communication system drastically reducing, and link 
between two routers going down leading to the use of alternate paths which lead to congestion 
and performance. 

14. (Original) The method of claim 12, wherein capturing the abstract exception condition 
comprises: 

capturing normal paths based on predetermined criteria on which the events have to be 
diagnosed. 

15. (Original) The method of claim 14, wherein the criteria comprises: 
causal and temporal inconsistencies between events. 

16. (Original) The method of claim 1, wherein forming the FCM, comprises: 
capturing system event interdependencies. 

17. (Original) The method of claim 15, wherein capturing the system event 
interdependencies comprises: 

interconnecting event and concept nodes using interdependency arcs capturing temporal 
and logical dependencies. 

1 8. (Original) The method of claim 1 7, wherein the interdependency arcs comprise: 
weights based on temporal and logical dependencies. 
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19. (Original) The method of claim 3, wherein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 

computing an indirect effect of events (predictive event-correlation) on concept nodes 

using the equations: 

I px (Ei, Q) = min( e (E, Q)) = min( 6p% (E, E k )) © ®tmn( 6px (E to) q)) 

wherein the indirect effect of events Ei on concept nodes Q can be defined as the 

intersection of the linked causal types and can be described by the above equation, g^. is a 

function which takes Iy to [0,1] in path 'p' i.e. e Bj = f -> (Iy, u-y ), (J-y e {0,1}, and © represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

U ( Ma (X) > Mb W) = maX { °' Ma W + Mb W ~ 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions u A and 

u B . 

20. (Original) The method of claim 19, wherein mapping the received real-time events to the 
formed FCM fragments comprises: 

correlating the received events to the identified concept nodes to evaluate the effect of the 
received event nodes on the identified concept nodes using the determined element 
interdependencies. 

21 . (Original) The method of claim 20, wherein correlating the received events to the 
concept nodes further comprises: 

accumulating evidence based on the received event nodes; 
comparing the accumulated evidence to a threshold value; and 
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analyzing the concept nodes based on the outcome of the comparing to evaluate the effect 
of the received event nodes. 



22. (Currently Amended) A computer implemented method for diagnosing problems from 
multiple events in a communication network including managed components generating real- 
time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 

using network element interdependencies; 

sampling generated incoming real-time events from the network; and 

diagnosing each of the generated problems by mapping the received sampled events to 

the formed FCM fragments. 

23. (Original) The method of claim 22, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

24. (Original) The method of claim 23, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

25. (Original) A computer readable medium having computer-executable instructions to 
diagnose problems from multiple events in a system of managed components generating real- 
time events of problems, comprising: 
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forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
sampling generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

26. (Original) The computer readable medium of claim 25, wherein forming the FCM 
fragments comprises: 

determining event nodes from events in the database; 
identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

27. (Previously Presented) The computer readable medium of claim 26, wherein diagnosing 
the sampled events comprises: 

mapping the sampled real-time events to the formed FCM fragments including 
determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on activation levels of the 
concept nodes; and 

diagnosing the problems based on the outcome of the analysis. 

28. (Original) The computer readable medium of claim 27, wherein the system comprises: 
a system selected from the group consisting of explicit system, implicit system, 

centralized system, partially centralized system, and distributed system. 



29. (Original) The computer readable medium of claim 28, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 



AMENDMENT AND RESPONSE UNDER 37 CFR § 1.116- EXPEDITED PROCEDURE Page 8 

Serial Number: 10/034,689 Dkt: 1488.015US1 

Filing Date: December 28, 2001 

Title: A METHOD OF NETWORK MODELING AND PREDICTIVE EVENT CORRELATION IN A COMMUNICATION SYSTEM 
BY THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 

30. (Previously Presented) The computer readable medium of claim 29, wherein the event 
nodes comprise: 

significant events selected from the group consisting of hardware failures, software 
failures, performance bottlenecks, configuration problems, and security violations. 

3 1 . (Original) The computer readable medium of claim 27, wherein identifying the concept 
nodes comprises: 

identifying a composite set of events that capture the notion of an abstract exception 
condition in the network. 

32. (Original) The computer readable medium of claim 27, wherein evaluating the effect of 
the received event nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 

I px (Ei, CO = min( €px (E, Cj)) = min( 6p% (E b E k )) ® © min( ^ (E ta> Cj)) 

wherein the indirect effect of events E ; on concept nodes Q can be defined as the 
intersection of the linked causal types and can be described by the above equation, g px is a 

function which takes ly to [0,1] in path 'p' i.e. eiy = f -» (Iy, Liy ), Uij e {0,1}, and © represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

t l (jU A (*), JU B (*)) = max {0, ju a (x) + JU B (*) - 1} 

wherein tj() is a t-norm between fuzzy sets A and B with membership functions u A and 

Mb- 

33. (Original) A computer system to diagnose problems from multiple events in a system of 
managed components generating real-time events of problems, comprising: 

a storage device; 



AMENDMENT AND RESPONSE UNDER 37 CFR § 1 .1 1 6 - EXPEDITED PROCEDURE Page 9 

Serial Number: 10/034,689 Dkt: 1488.015US! 

Filnm Date: December 28, 2001 

Title: A METHOD OF NETWORK MODELING AND PREDICTIVE EVENT CORRELATION IN A COMMUNICATION SYSTEM 
BY THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 

an output device; and 

a processor programmed to repeatedly perform a method, comprising: 
forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 
sampling generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

34. (Original) The system of claim 33, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

35. (Original) The system of claim 34, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes evaluate the effect of the mapped event nodes on the identified concept 
nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

36. (Original) The system of claim 35, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

37. (Previously Presented) The system of claim 35, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 
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38. (Original) The system of claim 35, wherein identifying the concept nodes comprises: 
identifying a composite set of events that capture the notion of an abstract exception 
condition in the network. 



39. (Original) The system of claim 35, wherein forming the FCM, comprises: 
capturing system event interdependencies by interconnecting event and concept nodes 

using interdependency arcs that capture temporal and logical dependencies. 

40. (Original) The system of claim 35, wherein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 

I px (E i; CO = min( 6px (Ei, Q)) = min( Bp% ^ (E,, E k )) © © min( (E*. Cj)) 

wherein the indirect effect of events Ej on concept nodes Cj can be defined as the 
intersection of the link causal types and can be described by the above equation, q is a 

function which takes Iy to [0,1] in path 'p' i.e. e U} = f -> (h Wi )» Wl e {°> l )> md ® ^presents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 
'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

ttijUft), M B ( x » = max {°> Ma {X) + to " 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions ua and 

u B . 

41. (Original) An event-correlation system to diagnose problems from multiple incoming 
real-time events in a communication network of managed components generating real-time 
events of problems, comprising: 
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an event-analyzer to form fuzzy cognitive map (FCM) fragments using network element 
interdependencies derived from a database defining the network managed objects and event 
notifications that convey the state of one or more managed objects; and 

an event-processing module coupled to the event-analyzer to sample generated incoming 
real-time events from the network, wherein the analyzer to diagnose the problems from the 
sampled events by mapping the sampled events to the formed FCM fragments. 

42. (Original) The event-correlation system of claim 41, wherein the analyzer forms FCM 
fragments by determining event nodes from events in the database, and by further identifying 
concept nodes from the determined event nodes to form FCM fragments including 
interdependencies between the identified concept nodes and the determined event nodes. 

43 . (Original) The event-correlation system of claim 4 1 , wherein the analyzer further maps 
the sampled events to the formed FCM fragments including determined event nodes to evaluate 
the effect of the mapped events on the determined concept nodes using the determined 
interdependencies, wherein the analyzer identifies the problems by analyzing the concept nodes 
based on the outcome of the evaluation and further diagnoses the problems based on the outcome 
of the analysis. 

44. (Original) The event-correlation system of claim 43, wherein the communication 
network comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 

45. (Original) The event-correlation system of claim 43, wherein the events comprise: 
exceptional conditions occurring during operation of the network. 



46. (Previously Presented) The event-correlation system of claim 45, wherein the event 
nodes comprise: 
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significant events selected from the group consisting of hardware failures, software 
failures, performance bottlenecks, configuration problems, and security violations. 



47. (Original) The event-correlation system of claim 46, wherein the analyzer determines the 
event nodes from a database defining the network managed- objects and event notifications that 
convey the state of one or more managed objects. 

48. (Original) The event-correlation system of claim 47, wherein the analyzer determines the 
event nodes from expert knowledge of the network. 

49. (Original) The event-correlation system of claim 48, wherein the managed objects 
comprise: 

objects selected from the group consisting of network objects, attached systems, and 
application objects. 

50. (Previously Presented) The event-correlation system of claim 48, wherein the database 
comprises: 

static information associated with each class of managed objects or dynamic information 
that affects the causal propagation of events. 

51. (Original) The event-correlation system of claim 43, further comprising: 

a communication interface module coupled between the network and the event- 
processing module to extract events from real-time messages received in different formats from 
the network and to further sample the extracted events sequentially in the order they are received. 

52. (Original) The event-correlation system of claim 43, wherein the analyzer identifying the 
concept nodes comprises a composite set of events that capture a notion of an abstract exception 
condition in the network. 
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53. (Original) The event-correlation system of claim 52, wherein the abstract exception 
condition comprises conditions selected from the group consisting of a notion of fault and a 
notion of performance degradation. 

54. (Original) The event-correlation system of claim 52, wherein the analyzer captures the 
abstract exception condition by capturing normal paths based on predetermined criteria from 
which for the events are diagnosed. 

55. (Original) The event-correlation system of claim 54, wherein the criteria comprises: 
causal and temporal inconsistencies between events. 

56. (Original) The event-correlation system of claim 43, wherein the analyzer forms FCM by 
capturing system event interdependencies. 

57. (Original) The event-correlation system of claim 56, wherein the analyzer captures 
system interdependencies by interconnecting event and concept nodes using interdependency 
arcs to capture temporal and logical dependencies. 

58. (Previously Presented) The event-correlation system of claim 57, wherein the 
interdependency arcs comprise: 

weights based on temporal and logical dependencies. 

59. (Original) The event-correlation system of claim 43, wherein the analyzer evaluates an 
indirect effect of events on concept nodes using the equations: 

I px (Ei, CO = min( e (E;, Q)) = min( (E;, E k )) © © min( ^ (E ta , Q)) 

wherein the indirect effect of events Ej on concept nodes Q can be defined as the 

intersection of the link causal types and can be described by the above equation, p is a 

px 

function which takes Iy to [0,1] in path 'p' i.e. e nj = f -» (Iy, py ), py e {0,1}, and © represents a 
concatenation of paths, wherein the concatenation operator© is generally considered as a fuzzy 



AMENDMENT AND RESPONSE UNDER 37 CFR § 1 .1 1 6 - EXPEDITED PROCEDURE Page 1 4 

Serial Number: 10/034,689 Dkt: 1488.015US1 

Filing Date: December 28, 2001 

Title: A METHOD OF NETWORK MODELING AND PREDICTIVE EVENT CORRELATION IN A COMMUNICATION SYSTEM 
BY THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 

'and' operator, wherein the operator (t-norm) for intersection of two fuzzy sets other than 'min' 
can be used using a 'bounded difference,' wherein the bounded difference can be computed 
using the equation: 

U ( JU A (x), JU B (*)) = max {0, jU a (x) + JU b (x) - 1} 

wherein t]() is a t-norm between fuzzy sets A and B with membership functions u A and 

u B . 

60. (Original) The event-correlation system of claim 59, wherein the analyzer maps the 
received real-time events to the formed FCM fragments by correlating the received events to the 
identified concept nodes to evaluate the effect of the received event nodes on the identified 
concept nodes using the determined element interdependencies. 

61 . (Original) The event-correlation system of claim 59, wherein the analyzer correlates the 
received events by accumulating evidence based on the received event nodes and compares the 
accumulated evidence to a threshold value, and analyzes the concept nodes based on the outcome 
of the comparing to evaluate the effect of the received event nodes. 

62. (Original) The event-correlation system of claim 43, further comprising: 

an interface output module coupled to the event-analyzer to output one or more solutions 
based on the outcome of diagnosing the problems by the analyzer. 

63. (Original) The event-correlation system of claim 62, further comprising: 
a memory to store the static and dynamic information. 



